DEPLOY AND CONFIGURE AZURE BASTION TO ACCESS AZURE WORKLOAD MACHINES SECURELY (AZURE PROJECT-5.1)
Project
An IT services Provider Company PRAfect Systems Inc. is engaged into providing software development solutions. Currently, the infrastructure management has started facing a challenges due to managing and maintaining the Azure workload and virtual machines accessibility rights. As due to high amount of cyber-attacks there needs to be more secure way through which Cloud Engineer team can access the workload machines securely.
The challenge is that the workload machine should be only accessible privately without having Public IP’s so that it can stay secure and connected more securely within the organization’s infrastructure management team.
There are numerous instances for which infrastructure team has got a request to implement a secure and private connection to all those Azure Workload Machines so it can get restricted access within an organization.
As a solution for this challenge is to implement Azure Bastion service which provides secure and private connectivity to all Azure workload machines without assigning Public IP’s to those workload virtual machines.
Solution:
What is Azure BASTION?
Azure Bastion is a service you deploy that lets you connect to a virtual machine using your browser and the Azure portal. The Azure Bastion service is a fully platform-managed PaaS service that you provision inside your virtual network. It provides secure and seamless RDP/SSH connectivity to your virtual machines directly from the Azure portal over TLS. When you connect via Azure Bastion, your virtual machines don’t need a public IP address, agent, or special client software.
Bastion provides secure RDP and SSH connectivity to all of the VMs in the virtual network in which it is provisioned. Using Azure Bastion protects your virtual machines from exposing RDP/SSH ports to the outside world, while still providing secure access using RDP/SSH.
Key Features:
RDP and SSH through the Azure portal Remote Session over TLS and firewall traversal for RDP/SSH No Public IP address required on the Azure VM No hassle of managing Network Security Groups (NSGs) No need to manage a separate bastion host on a VM Protection against port scanning Hardening in one place only Protection against zero-day exploits
Description
This project was a challenge project to deploy Azure Firewall to protect organization’s workload on Azure Cloud.
The Bastion host is deployed in the virtual network that contains the AzureBastionSubnet subnet that has a minimum /26 prefix. The user connects to the Azure portal using any HTML5 browser. The user selects the virtual machine to connect to. With a single click, the RDP/SSH session opens in the browser. No public IP is required on the Azure VM.
Project Cost Estimation:
(Note: This cost is Not any actual cost, it’s just an estimation based on high level requirement. Price may be vary based on adding and removing services based on requirement.)
https://azure.microsoft.com/en-us/pricing/calculator/
Tools & Technologies covered:
Azure Cloud
Azure Virtual Network
Azure Virtual Machine
Azure Bastion
Solution Architecture:
This project will be completed in following implementation phases.
Project implementation Phase:
Phase 1: Deploy a VNet
Task -1 Create a Resource Group
Task -2 Create a VNET
Phase 2: Deploy a Windows Virtual machine
Phase 3: Deploy a Linux Virtual Machine
Phase 4: Deploy Bastion to the Vnet
Phase 5: Connect to a Windows Virtual Machine
Phase 6: Connect to a Linux Virtual Machine
Pre-requisite:
1) Azure Cloud Portal Subscription
2) VM in a Vnet
3) Required VM Roles: o Reader role on the virtual machine. o Reader role on the NIC with private IP of the virtual machine.
4) Required VM ports inbound ports: o 3389 for Windows VMs o 22 for Linux VMs
Implementation in an Action:
Phase 1: Deploy a VNet
Phase 2:
Deploy a Windows Virtual machine
Create VM
Phase 4: Deploy Bastion to the Vnet
Deploy Bastion
1.Go to Vnet
Get PRAFUL PATEL ☁️ 𝐂𝐥𝐨𝐮𝐝 𝐄𝐧𝐠𝐢𝐧𝐞𝐞𝐫 ☁️’s stories in your inbox
Join Medium for free to get updates from this writer.
2.Select Bastion
3.I want to configure Azure Bastion my own
Create bastionsubnet
Bastion deployed successfully
Phase 6 :
Connect to a Win dows Virtual Machine
Connect to VM
Remove Public IP from virtual machine
Click to Diassociate
Click to Delete the public ip
Verify that public ip has been removed
Verify that virtual machine is still able to connect via Bastion without Public Ip of virtual machine
Virtual machine is accessible using Bastion in Browser
Phase 6 : Connect to a Linux Virtual Machine
Linux VM
Connect to Linux VM
Select private key file
Linux VM connected successfully using Bastion
Remove Public IP address from VM
Public IP removed successfully from Linux VM
Reconnect Linux VM without Public IP
Ref:https://docs.microsoft.com/en us/azure/bastion/quickstart host portal
Congratulations!!!! 🔥🚀
